While cloud computing is gaining popularity, diverse security and privacy issues are emerging that hinder the rapid adoption of this new computing paradigm. And the development of defensive solutions is lagging behind. To ensure a secure and trustworthy cloud environment it is essential to identify the limitations of existing solutions and envision directions for future research. In this paper, we have surveyed critical security and privacy challenges in cloud computing, categorized diverse existing solutions, compared their strengths and limitations, and envisioned future research directions.

No abstract

No abstract

Cloud computing is a model for on-demand delivery of IT resources (e.g., servers, storage, databases, etc.) over the Internet with pay-as-you-go pricing. Although it provides numerous benefits to cloud service users (CSUs) such as flexibility, elasticity, scalability, and economies of scale, there is a large trust deficit between CSUs and cloud service providers (CSPs) that prevents the widespread adoption of this computing paradigm. While some businesses have slowly started adopting cloud computing with careful considerations, others are still reluctant to migrate toward it due to several data security and privacy issues. Therefore, the creation of a trust model that can evolve to reflect the true assessment of CSPs in terms of either a positive or a negative reputation as well as quantify trust level is of utmost importance to establish trust between CSUs and CSPs. In this paper, we propose a fuzzy-logic based approach that allows the CSUs to determine the most trustworthy CSPs. Specifically, we develop inference rules that will be applied in the fuzzy inference system (FIS) to provide a quantitative security index to the CSUs. One of the main advantages of the FIS is that it considers the uncertainties and ambiguities associated with measuring trust. Moreover, our proposed fuzzy-logic based trust model is not limited to the CSUs as it can be used by the CSPs to promote their services through self-evaluation. To demonstrate the effectiveness of our proposed fuzzy-based trust model, we present case studies where several CSPs are evaluated and ranked based on the security index.

The Cloud computing paradigm provides numerous attractive services to customers such as the provision of the on-demand self-service, usage-based pricing, ubiquitous network access, transference of risk, and location independent resource sharing. However, the security of cloud computing, especially its data privacy, is a highly challengeable task. To address the data privacy issues, several mechanisms have been proposed that use the third party auditor (TPA) to ensure the integrity of outsourced data for the satisfaction of cloud users (CUs). However, the role of the TPA could be the potential security threat itself and can create new security vulnerabilities for the customer's data. Moreover, the cloud service providers (CSPs) and the CUs could also be the adversaries while deteriorating the stored private data. As a result, the objective of this research is twofold. Our first research goal is to analyze the data privacy-preserving issues by identifying unique privacy requirements and presenting a supportable solution that eliminates the possible threats towards data privacy. Our second research goal is to develop the privacy-preserving model (PPM) to audit all the stakeholders in order to provide a relatively secure cloud computing environment. Specifically, the proposed model ensures the quality of service (QoS) of cloud services and detects potential malicious insiders in CSPs and TPAs. Furthermore, our proposed model provides a methodology to audit a TPA for minimizing any potential insider threats. In addition, CUs can use the proposed model to periodically audit the CSPs using the TPA to ensure the integrity of the outsourced data. For demonstrating and validating the performance, the proposed PPM is programmed in C++ and tested on GreenCloud with NS2 by applying merging processes. The experimental results help to identify the effectiveness, operational efficiency, and reliability of the CSPs. In addition, the results demonstrate the successful rate of handling the negative role of the TPA and determining the TPA's malicious insider detection capabilities.